This independent checklist covers the protocol surfaces most likely to fail during a UCP launch: profile discovery, version selection, capability negotiation, transport, signatures and checkout outcomes. It is derived from the cited specifications and does not represent certification by the UCP project.
Key takeaways
- Test declarations and runtime behavior together.
- Preserve raw, redacted evidence for every result.
- Separate protocol failure from a valid commerce outcome.
- Re-run the suite whenever a dated protocol component changes.
Gate 1: discovery
Fetch /.well-known/ucp as an external client. Pass only when the profile is served directly over HTTPS, returns valid JSON and follows the cache requirements of the current specification. Record status, headers, body hash and test time.
Fail the release when the public response differs from the reviewed profile. A local file does not prove the deployed discovery document.
Gate 2: version handling
Test the current protocol version, every advertised older version and one unsupported date. Confirm that version-specific profiles are complete and stable. The unsupported request must produce the documented version outcome without creating a cart, checkout or order resource.
Keep protocol-version assertions separate from capability-version assertions.
Gate 3: capability negotiation
Create platform fixtures that share all, some or none of the business capabilities. Verify intersection, compatible versions and repeated extension pruning. Confirm that each response advertises only the active capabilities relevant to that operation.
Required cases:
- Shared root capability.
- Unsupported optional extension.
- Extension with missing parent.
- Transitive extension chain.
- Empty intersection for a required operation.
Gate 4: transport and signatures
For REST, discover the base URL from the profile and use the operation paths defined by the negotiated binding. Send the platform profile through UCP-Agent. Verify the JSON content type, TLS behavior and HTTP Message Signatures where required.
Include negative fixtures for a modified body, unknown key identifier, expired key and mismatched profile identity. Never log private keys, bearer tokens or full buyer data.
Gate 5: checkout lifecycle
Exercise create, get, update, complete and cancel behavior in an approved test environment. Validate responses against the dated checkout schema. Test recoverable buyer-input messages and an unrecoverable outcome such as a controlled unavailable item.
Do not require every business outcome to use HTTP 200. Assert the status and response structure defined by the current binding.
Gate 6: payment and authorization boundaries
Advertise only payment handlers the business can process. Ensure credentials flow in the permitted direction and are not echoed in responses. If the implementation supports the optional AP2 Mandates Extension, test its mandate and signature rules separately from core checkout behavior.
The absence of AP2 support does not by itself make a core UCP implementation invalid unless the negotiated journey requires that extension.
Gate 7: evidence and regression
For each test, store:
| Evidence | Required content |
|---|---|
| Fixture | Redacted input profile and request |
| Expected | Specification section and version |
| Actual | Status, headers and redacted body |
| Result | Pass, fail or not verified |
| Traceability | Commit, environment and timestamp |
A “not verified” result is not a pass. It records a limitation that must be resolved or accepted before release.
Release rule
Ship only when all required gates pass for the capabilities the business advertises. Optional capabilities can remain absent. If a failure appears after deployment, restore the last known-good profile and implementation together, then rerun the same fixtures. This approach tests an honest subset thoroughly instead of advertising a larger feature set the runtime cannot support.
Primary sources and review date
- UCP specification overview, version 2026-04-08, reviewed 2026-08-12.
- UCP checkout capability REST binding, reviewed 2026-08-12.
- Shopify agent quickstart, reviewed 2026-08-12.